10330 matches found
UBUNTU-CVE-2026-76641
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between ELEMENTTYPE members causes storeAtts to read the attIndex...
UBUNTU-CVE-2026-76878
In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...
UBUNTU-CVE-2026-68552
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr in src/client/nsturnmsg.c to...
UBUNTU-CVE-2026-76217
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...
UBUNTU-CVE-2026-71129
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...
UBUNTU-CVE-2026-1199
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...
UBUNTU-CVE-2026-74999
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS...
UBUNTU-CVE-2026-72887
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...
UBUNTU-CVE-2026-74491
In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in ofpcirangeparserone The bus matching rework made ofmatchbus return NULL for nodes with ranges/dma-ranges but no local address-cells. parserinit stored that NULL bus, and the range iterator...
UBUNTU-CVE-2026-74506
In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afsmakecall, there's a race with async call reception and destruction. If a call is dispatched that doesn't have call-writeiter set used to specify the data content for FS.StoreData, then th...
UBUNTU-CVE-2026-74539
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isosockgetname Accessing isopisk-conn requires locksock, which is not held here. Fix by adding the lock/release...
UBUNTU-CVE-2026-74490
In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipcskdump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sklock.slock, but tipcpoll calls...
UBUNTU-CVE-2026-74492
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...
UBUNTU-CVE-2026-74484
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...
UBUNTU-CVE-2026-74530
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectbigsync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previo...
UBUNTU-CVE-2026-74486
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...
UBUNTU-CVE-2026-72364
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writebackiter loop. If an error occurs, writebackiter needs to be called again with error set to the error so that it can clean up iteration state. Further, the curren...
UBUNTU-CVE-2026-72451
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...
UBUNTU-CVE-2026-74388
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...
UBUNTU-CVE-2026-74302
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...
UBUNTU-CVE-2026-72492
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sameclienthaslease sameclienthaslease returns an opinfo pointer from ci-moplist after dropping ci-mlock without taking a reference. smbgrantoplock then dereferences that pointer in copylease and when...
UBUNTU-CVE-2026-74314
In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpfobjfreefields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...
UBUNTU-CVE-2026-72380
In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a store, wi...
UBUNTU-CVE-2026-72383
In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...
UBUNTU-CVE-2026-72388
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...
UBUNTU-CVE-2026-72489
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...
UBUNTU-CVE-2026-72422
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read by...
UBUNTU-CVE-2026-72060
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssgndogetstats64 unconditionally calls emacgetstatbyname with FW PA stat names regardless of whether the PA stats block is present on the hardware. emacgetstatbyname already guard...
UBUNTU-CVE-2026-72238
In the Linux kernel, the following vulnerability has been resolved: x86/boot: Validate console=uart8250 baud rate to fix early boot hang When the baud rate is empty, 0, invalid, or overflows to 0 when stored as an int, the system will hang during early boot because of a division by zero in...
UBUNTU-CVE-2026-72014
In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...
UBUNTU-CVE-2026-72264
In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in subsequent error paths. Fix that by calling fbdestroymodelist...
UBUNTU-CVE-2026-72128
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If nvmetchecksqid fails, the function returns the error directly without releasing...
UBUNTU-CVE-2026-72082
In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efcthwioabort When efcthwreqtagalloc fails in efcthwioabort, the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero earlier in the function. All other...
UBUNTU-CVE-2026-72259
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment...
UBUNTU-CVE-2026-68464
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt When using WIFI out-of-band wakeup, an "irq xxx: nobody cared" warning occurs. This happens because the usdhc interrupt is not disabled during system...
UBUNTU-CVE-2026-14669
Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...
UBUNTU-CVE-2026-19696
Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows...
UBUNTU-CVE-2026-73146
GHSA-r2gm-p682-3mpm: svxreflector: use-after-free via reentrant client deletion...
UBUNTU-CVE-2026-63293
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...
UBUNTU-CVE-2026-59091
A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts witho...
UBUNTU-CVE-2026-68380
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mmstruct in job scheduler amdxdnacmdsubmit stores current-mm in job-mm without holding any reference. aie2schedjobrun later access job-mm from the DRM scheduler worker thread. With only a raw...
UBUNTU-CVE-2026-68101
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
UBUNTU-CVE-2026-68097
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...
UBUNTU-CVE-2026-66484
GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...
UBUNTU-CVE-2026-71394
GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...
UBUNTU-CVE-2026-71851
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...
UBUNTU-CVE-2026-62996
Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...
UBUNTU-CVE-2026-19079
A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...
UBUNTU-CVE-2026-64677
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...
UBUNTU-CVE-2026-71498
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...